CVE-2014-8896

IBM InfoSphere Master Data Management – Collaborative Edition and related Server for Product Information Management are affected by CVE-2014-8896, where an authenticated user could modify the administrator’s credentials and gain privileges. Affected products/versions include Collaborative Edition...

CVE-2014-8896

The Collaboration Server in IBM InfoSphere Master Data Management Server for Product Information Management 9.x through 9.1 and InfoSphere Master Data Management - Collaborative Edition 10.x through 10.1, 11.0 before FP7, and 11.3 and 11.4 before 11.4 FP1 allows remote authenticated users to modi...

CVE-2014-8898

Cross-site scripting XSS vulnerability in the Collaboration Server in IBM InfoSphere Master Data Management Server for Product Information Management 9.x through 9.1 and InfoSphere Master Data Management - Collaborative Edition 10.x through 10.1, 11.0 before FP7, and 11.3 and 11.4 before 11.4 FP1...

CVE-2014-8899

Cross-site scripting XSS vulnerability in the Collaboration Server in IBM InfoSphere Master Data Management Server for Product Information Management 9.x through 9.1 and InfoSphere Master Data Management - Collaborative Edition 10.x through 10.1, 11.0 before FP7, and 11.3 and 11.4 before 11.4 FP1...

CVE-2014-8897

Summary (CVE-2014-8897, related CVEs): IBM InfoSphere Master Data Management Collaboration Server is affected by cross-site scripting vulnerabilities due to improper validation of user-supplied input. The CVE-2014-8897 issue specifically describes a stored XSS enabling remote authenticated users ...

Code injection

IBM Tivoli Endpoint Manager Mobile Device Management MDM before 9.0.60100 uses the same secret HMAC token across different customers' installations, which allows remote attackers to execute arbitrary code via crafted marshalled Ruby objects in cookies to 1 Enrollment and Apple iOS Management...

CVE-2014-6140

IBM Tivoli Endpoint Manager Mobile Device Management MDM before 9.0.60100 uses the same secret HMAC token across different customers' installations, which allows remote attackers to execute arbitrary code via crafted marshalled Ruby objects in cookies to 1 Enrollment and Apple iOS Management...

CVE-2014-6140

IBM Endpoint Manager for Mobile Devices (TEM/Mobile Device Management) components including Enrollment and Apple iOS Management Extender, Self-Service Portal, Admin Portal, and Trusted Service Provider are affected. The root cause is that TEM uses static secret_token values across all installatio...

CVE-2014-6140: Undefined Security Weakness

IBM Tivoli Endpoint Manager Mobile Device Management MDM before 9.0.60100 uses the same secret HMAC token across different customers' installations, which allows remote attackers to execute arbitrary code via crafted marshalled Ruby objects in cookies to 1 Enrollment and Apple iOS Management...

PT-2014-7063

Name of the Vulnerable Software and Affected Versions IBM Tivoli Endpoint Manager Mobile Device Management MDM versions prior to 9.0.60100 Description The issue allows remote attackers to execute arbitrary code via crafted marshalled Ruby objects in cookies to various endpoints, including 1...

IBM Releases Security Update for MDM

IBM has released Tivoli Endpoint Manager Mobile Device Management MDM version 9.0.60100 to address a vulnerability which may allow a remote attacker to gain control of an affected system. Users and administrators are encouraged to review the IBM Security Bulletin and apply the necessary updates...

Directory traversal

Directory traversal vulnerability in ZOHO ManageEngine Desktop Central DC before 9 build 90055 allows remote attackers to execute arbitrary code via a .. dot dot in the fileName parameter to mdm/mdmLogUploader...

PT-2014-6246

Name of the Vulnerable Software and Affected Versions ManageEngine Desktop Central versions prior to 9 build 90055 Description The issue allows remote attackers to execute arbitrary code via a .. dot dot in the fileName parameter to the "mdm/mdmLogUploader" endpoint. This is a directory traversal...

CVE-2014-3063

IBM InfoSphere Master Data Management - Collaborative Edition 10.x before 10.1-FP11 and 11.x before 11.0-FP5 and InfoSphere Master Data Management Server for Product Information Management 9.x before 9.1-FP15 and 10.x and 11.x before 11.3-IF2 allow local users to obtain administrator privileges v...

CVE-2014-0966

SQL injection vulnerability in the GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.x and 11.x before 11.0-FP5 and InfoSphere Master Data Management Server for Product Information Management 9.x through 11.x before 11.3-IF2 allows remote authenticated users to...

Design/Logic Flaw

IBM InfoSphere Master Data Management - Collaborative Edition 10.x before 10.1-FP11 and 11.x before 11.0-FP5 and InfoSphere Master Data Management Server for Product Information Management 9.x before 9.1-FP15 and 10.x and 11.x before 11.3-IF2 do not properly protect credentials, which allows remo...

CVE-2014-0966

IBM InfoSphere Master Data Management - Collaborative Edition (GDS component) and the related Server for Product Information Management are affected by CVE-2014-0966. The vulnerability is an SQL injection (blind) that could allow a remote authenticated attacker to view, add, modify, or delete dat...

CVE-2014-0971: IBM InfoSphere Master Data Management - Collaborative Edition session fixation

IBM InfoSphere Master Data Management - Collaborative Edition is affected by a session fixation vulnerability: the application does not upgrade the session identifier after successful authentication, potentially allowing an attacker to impersonate an authenticated user by using the victim’s sessi...

Design/Logic Flaw

The GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.0 through 11.0 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 does not properly handle FRAME elements, which makes it easier for remote authenticated users to conduct...

CVE-2014-0967

Cross-site scripting XSS vulnerability in the GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.x and 11.x before 11.0 FP4 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 allows remote authenticated users to inject...